Semaphore OS Command Injection Vulnerability: Critical Early Warning
- Severity
- CRITICAL
- Affected component
- semaphore (go)
- Affected versions
- < 0.0.0-20260704181911-7e8a9434bd81
- Patched version
- Not yet available
An OS command injection vulnerability has been identified in Semaphore, affecting versions prior to 0.0.0-20260704181911-7e8a9434bd81. This vulnerability allows users with Manager or Owner roles to execute remote code on the Semaphore server host.
What happened
An OS command injection vulnerability in Semaphore's git_url handling has been reported. This vulnerability enables any user with Manager or Owner role to execute remote code on the Semaphore server host. The issue is reproducible on a default installation without requiring any non-default configurations. The vulnerability was first flagged on September 8, 2026, and is currently under investigation.
The affected component is the semaphore (go) package, specifically versions prior to 0.0.0-20260704181911-7e8a9434bd81. The vulnerability has been tracked under GHSA-XP7J-H7JC-4W8P and CVE-2026-73294. There is no evidence that this vulnerability has been exploited in the wild at this time.
What to do about it
- Upgrade to the latest version of Semaphore that patches this vulnerability.
- Review your Semaphore server configurations for any signs of compromise.
- Monitor the primary sources for updates on this vulnerability.
- Ensure that only trusted users have Manager or Owner roles in your Semaphore instance.
- Consider implementing additional security measures to restrict OS command execution within your Semaphore environment.
How 0Day would have caught this
semaphore is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using semaphore (go) version prior to 0.0.0-20260704181911-7e8a9434bd81.
What should I do right now?
Upgrade to the latest version of Semaphore and review your server configurations for any signs of compromise.
Is there an official fix available?
Yes, upgrade to version 0.0.0-20260704181911-7e8a9434bd81 or later.
Where can I find more information?
Consult the primary sources: GHSA-XP7J-H7JC-4W8P and CVE-2026-73294.